Is DarkComet Still a Threat in 2026? What US Users Should Know

If you searched for "DarkComet scam," you probably saw a warning on your computer, a security alert from your antivirus, or a headline about remote access malware. Here is the short version: DarkComet is a real piece of Windows malware, but it is not the name of a specific scam, and no public report in 2026 ties it to a new campaign against Americans. The remote access threats that are hitting US users this year use other names, and they reach people through fake software downloads, fake CAPTCHA pages and fake tech support calls.

I have spent the past few weeks reading the original threat research from MITRE, Cisco Talos, the Center for Internet Security, the SANS Internet Storm Center, Recorded Future and the FBI. A lot of what circulates online about DarkComet mixes up an old malware family with brand new campaigns. That confusion matters, because people who think they are looking for one specific threat often miss the much more common ways remote access attacks actually start.

This guide separates what is confirmed from what is not. It explains what DarkComet can do, which 2026 campaigns have documented US victims, which trusted software names attackers are copying, and exactly what to do if you think someone has remote access to your computer.

What is DarkComet?

MITRE ATT&CK, the public knowledge base security teams use to classify attacker tools, describes DarkComet as a Windows remote administration tool and backdoor. Its MITRE ID is S0334. It is also known by the names DarkKomet, Fynloski, Krademok and FYNLOS, which is why antivirus products sometimes report it under a label that does not include the word "DarkComet" at all.

A remote access Trojan, or RAT, is software that gives someone else hidden control over your computer. Legitimate remote support tools exist and are used every day by IT departments. What makes a RAT malicious is that it is installed without your informed consent and used to spy on you, steal from you or install more malware.

MITRE lists the specific techniques DarkComet has been documented using. In plain English, they look like this:

MITRE also records which threat groups have used DarkComet: Transparent Tribe, SilverTerrier and APT38. Those references come from older research, and they show how widely the tool spread once it became available. They do not mean those groups are using it against ordinary US consumers today.

Is DarkComet still active in 2026?

This is the question most people searching the name want answered, and the honest answer has two parts.

First, the malware family is still around. In its H1 2026 malware and vulnerability trends report, Recorded Future listed DarkComet among the top ten malware families by unique file hashes in its malware intelligence data for the first half of 2026. The other families on that list were AsyncRAT, Cobalt Strike, Gh0st RAT, Remcos RAT, XWorm, njRAT, QuasarRAT, SheetRAT and StealC. Seven of the ten are remote access tools, which tells you how central RATs remain to cybercrime.

Second, a high sample count is not the same as a campaign. Old malware keeps circulating for years. Copies get repackaged, uploaded to file sharing sites, scanned by researchers and submitted to sandboxes. That activity shows up in threat data. It does not tell us who is running it, who the victims are, or whether Americans are being targeted.

If your antivirus flagged a file as DarkComet or Fynloski, take it seriously. Follow the steps in the already affected section below. But if you are trying to understand what is actually putting US computer users at risk this year, the bigger picture lies in the campaigns below.

The RAT campaigns actually hitting US users in 2026

Three operations stand out in 2026 public reporting because they have documented US victims and well sourced details. None of them has been attributed to DarkComet. These separate campaigns show how remote-access threats currently reach US users. They are included for context, not as evidence of DarkComet activity.

1. UAT-11795 and Starland RAT: fake Zoom, WebEx and developer tools

In July 2026, Cisco's threat research team Talos disclosed a campaign by a financially motivated actor it tracks as UAT-11795. The group delivers a Python based remote access tool that Talos named Starland RAT, along with a memory resident command and control implant called the WLDR agent. Talos also found that the group keeps two other malware families, CastleStealer and Remcos RAT, as alternative payloads.

According to a PolySwarm summary of the Talos findings, the actor is believed to be Russian speaking based on developer artifacts, has been active since at least June 2025, and its victims are primarily in the United States, with additional activity seen in Germany, Romania and Venezuela. Cryptocurrency wallets, browser credentials and enterprise systems were the main targets.

The lure is a fake installer. Talos observed weaponized installers posing as MobaXterm, Cisco WebEx, Zoom, DBeaver Community Edition and FACEIT. As BleepingComputer reported from the Talos analysis, the attack starts with an HTA file that downloads a trojanized installer. Inside it is a Python loader disguised as a harmless LICENSE.txt file, which changes the Windows Registry so it survives a restart and then loads Starland RAT into memory.

The practical lesson is simple. If you downloaded Zoom, WebEx or a developer tool from anywhere other than the vendor's own website, you could not have known the file was poisoned just by looking at it.

2. ZPHP (SmartApeSG): fake CAPTCHA pages on real websites

The Center for Internet Security, which supports US state and local governments, reported an ongoing ZPHP campaign affecting US state, local, tribal and territorial government organizations and delivering Remcos RAT. CIS traced its investigation to a detection on January 28, 2026, then found three more government organizations with similar alerts in February 2026. Its network monitoring system logged 61 ZPHP related alerts at the start of the year.

The same campaign is tracked by researchers under the names SmartApeSG and HANEYMANEY. The SANS Internet Storm Center explains how it works: attackers inject scripts into legitimate websites they have compromised. When you visit, the site shows a fake "verify you are human" page.

Then comes the trick. Instead of asking you to click pictures of traffic lights, the page quietly copies a command to your clipboard and tells you to press the Windows key and R, paste, and hit Enter. Security researchers call this technique ClickFix. When you follow the instructions, you are the one who runs the malware, which helps it slip past security tools that watch for automatic downloads. SANS documented one wave in March 2026 that delivered Remcos RAT, NetSupport RAT, StealC and Sectop RAT from a single infection.

3. Tech support and government impersonation call centers

The third threat is not a piece of malware at all, but it ends in the same place: a stranger controlling your computer. Fake tech support callers persuade victims to install legitimate remote access software, then use that access to steal money. I cover the largest documented 2026 case in detail in the real case section below.

How a remote access attack reaches you, step by step

The three campaigns above look different on the surface, but they share the same basic shape. Once you see it, it becomes much easier to recognize.

Step 1: The lure

Something gets your attention. It might be a search result or ad for a free Zoom download, a "verify you are human" box on a website you trust, or a loud pop-up claiming your computer is infected with a number to call. Every lure borrows trust from something familiar: a well known app, a routine security check, or a big brand like Microsoft or Apple.

Step 2: You are asked to act

This is the most important step, and it is the one you control. Modern remote access attacks rarely break into a computer on their own. They need you to run an installer, paste a command or read a code to a caller so they can connect. The whole operation is designed to make that action feel normal and urgent at the same time.

Step 3: Access is established

Once you act, the attacker gets in. In the Starland campaign, Talos found the malware hid in memory and set itself to run at startup. In the ZPHP campaign, the pasted command pulled down Remcos RAT. In tech support fraud, the "technician" simply connects through a real remote support app you installed at their request.

Step 4: The damage

With access in place, the goals are almost always financial. Starland RAT targeted crypto wallets and saved browser passwords. Tech support callers used access to show victims fake "proof" of hacking and then directed them to move savings. RATs like DarkComet add the risk of webcam and microphone spying, which can lead to extortion. If you want to see how real-world insiders abuse company data, check our case study on the Tech Support Scam Calls Are Now After Your Bank Account.

Which software names are being used as bait

The real versions of these products are safe and widely used. The danger comes from fake copies downloaded from ads, look alike websites or file sharing links. Here is who each lure tends to catch, based on the campaigns above.

Notice who is on that list. IT administrators and developers are targeted because one compromised work laptop can open the door to an entire company. Gamers are targeted because they install a lot of third party software and often store crypto. Older adults are targeted by phone because they tend to have savings and may trust an official sounding voice.

Malware names you may see in an antivirus alert

How big is the problem? What the data shows

Malware infections are not tracked as a single loss category in federal data. The scams that depend on getting into your computer, however, are. The FBI's Internet Crime Complaint Center groups call center fraud under tech support and government impersonation, and both have grown sharply.

In its 2025 Internet Crime Report, published in April 2026, IC3 recorded 47,794 tech support complaints with $2,134,675,818 in reported losses, and 32,424 government impersonation complaints with $797,943,193 in losses. Government impersonation complaints nearly doubled from 17,367 in 2024.

Older Americans carry a heavy share of this. The same IC3 report shows more than 21,000 tech and customer support complaints from people aged 60 and over in 2025, second only to phishing among that age group.

Keep in mind that these are only the cases people report. FBI officials said during the Maryland investigation that the true number of victims is likely much higher, because many people never come forward.

A real case: 660 Americans and $48.7 million

In February 2026, the FBI Baltimore Field Office, Montgomery County Police and the Montgomery County State's Attorney's Office announced the results of a joint investigation. They traced scams reported by Maryland residents to call center operations in India that had been targeting Americans since 2022.

According to IC3 data cited by the FBI, about 660 people in the United States reported being victims of government impersonation and tech support scams linked to those call centers, with losses totaling $48,778,230. Nearly two dozen Maryland complaints alone accounted for $6,257,869.

The script combined the two scam types. Victims were contacted by someone claiming to be from tech support or a well known company, often persuaded to install software that gave the caller access to their computer, and then passed to someone claiming to be a federal agent. NBC Washington reported that two Maryland victims who spoke at the news conference were first told by email that their Social Security numbers had been used in a crime. Local prosecutors said many of the people they charged were couriers sent to collect gold bars from victims who believed they were protecting their savings.

What stands out to me about this case is that none of it required sophisticated malware. The "remote access" was a legitimate support app, installed by the victim because a convincing voice told them to. That is why the advice in this guide focuses on the moment you are asked to act, not just on antivirus software.

Red flags: signs someone has remote access to your PC

Some warning signs appear before you are compromised. Others appear after. If you notice any of these, stop and check.

• A website asks you to press Windows + R or open PowerShell. No real CAPTCHA, browser update or "fix" works this way. This is the ClickFix trick used in the ZPHP campaign.
• You downloaded software from an ad or an unfamiliar site. Zoom, WebEx and developer tools copied by UAT-11795 should only come from the vendor's own domain. Attackers use a technical backend trick called cloaking to pass these links; learn more in our guide on How to Spot a Google Search Ad Scam.
• A pop-up says your computer is infected and gives a phone number. Microsoft and Apple do not put support phone numbers in warning pop-ups.
• Someone you did not call asks for remote access. A caller who wants you to install AnyDesk, TeamViewer or a similar tool is the single biggest warning sign of tech support fraud.
• Your mouse moves on its own, or windows open by themselves. That can mean someone is controlling the computer right now.
• Windows Security or your antivirus has been switched off. RATs including DarkComet are documented as disabling firewall and antivirus tools.
• Your webcam light turns on when you are not using it. Camera capture is a documented RAT capability.
• You get password reset or login alerts you did not request. Stolen browser passwords are often used within hours.
• Your crypto wallet address changes when you paste it. Clipboard theft can swap in the attacker's address.

Real download vs fake installer: a quick comparison

How to protect yourself and your family

You do not need to be technical to block nearly every attack described here. These habits cover the ways all three 2026 campaigns reached their victims.

1. Download only from the official source. Type the company's web address yourself instead of clicking ads or search results. For Zoom that is zoom.us, for WebEx it is webex.com.
2. Never paste a command a website gives you. If a page asks you to press Windows + R, open PowerShell or open Terminal, close the tab.
3. Check the publisher before you install. On Windows, right-click the installer, choose Properties, open the Digital Signatures tab and confirm the company name matches the real vendor.
4. Refuse unsolicited remote access. Hang up on any caller who asks you to install software or read them a code. Call the company back using a number from its official website.
5. Keep Windows Security and updates turned on. They will not stop every attack, but they catch many known RATs, including old families like DarkComet.
6. Turn on two-step verification. Use an authenticator app for email, banking and crypto exchanges, so a stolen password alone is not enough.
7. Keep crypto recovery phrases off your computer. Never store a seed phrase in a text file, note app, screenshot or browser.
8. Cover or disconnect your webcam when not in use. It is a simple, effective defense against camera spying.
9. Talk to older relatives. A two minute conversation about tech support calls can prevent a life changing loss. Our free printable scam safety card is an easy way to start.

If an unknown number has been calling you about a "computer problem," you can check it with our free robocall checker to see whether others have reported it.

Already affected? What to do right now

If you ran a suspicious installer, pasted a command, received a DarkComet or Fynloski alert, or let a stranger connect to your computer, act quickly. These steps are listed in order of urgency.

1. Disconnect from the internet. Unplug the network cable or turn off Wi-Fi. This cuts the attacker's connection.
2. End any remote session. Close and uninstall any remote access app a caller asked you to install.
3. Call your bank or card issuer immediately if money moved. Explain it was fraud and ask them to recall or stop the transfer. Speed matters most here.
4. Change passwords from a different, clean device. Start with email, then banking and crypto exchanges. Turn on two-step verification as you go.
5. Contact any crypto exchange you use. Report the incident through its official support channel and give them any wallet addresses involved.
6. Report to the FBI. File a complaint at IC3.gov with dates, phone numbers, websites and transaction details.
7. Report to the FTC. File at ReportFraud.ftc.gov.
8. Protect your identity. If personal data or ID documents may have been exposed, place a fraud alert or credit freeze with Equifax, Experian and TransUnion, and get a recovery plan at IdentityTheft.gov.
9. Get the computer cleaned or reset. Have a trusted local technician check it, or reset Windows, before you use it for banking again. Some RATs survive a simple antivirus scan.

If you are 60 or older, the National Elder Fraud Hotline at 1-833-FRAUD-11 (1-833-372-8311) offers free help with reporting and next steps. More official contacts are on our fraud help resources page.

Watch out for the second scam: fake recovery agents

After a tech support scam or malware infection, many victims get a second contact from someone promising to recover their money. They may claim to be a lawyer, a "crypto tracing" firm or an FBI agent handling IC3 complaints. Our guide to Why Past Scam Victims Are Being Targeted Again explains this double fraud pattern in more detail.

In a public service announcement on July 20, 2026, the FBI warned that criminals are posing as FBI staff who handle IC3 complaints and contacting past victims through social media and messaging apps. The FBI was clear that IC3 does not contact victims that way to recover funds.

These offers almost always ask for an upfront fee, your ID documents, your wallet recovery phrase or, ironically, remote access to your computer. Any of those requests means it is a scam. Our guide to recovery scams that target past victims explains the pattern in more detail, and our senior scam trends guide covers the warning signs for older relatives.

Frequently asked questions

How we researched this article

This article is based on primary threat research and government data: the MITRE ATT&CK entry for DarkComet, Recorded Future's H1 2026 malware trends report, Cisco Talos research on UAT-11795, the Center for Internet Security's ZPHP report, SANS Internet Storm Center analysis, the FBI's February 2026 Maryland announcement and the FBI IC3 2025 Internet Crime Report. Where a primary report was summarized by a secondary outlet, the outlet is named next to the claim. We treat DarkComet, Starland RAT, Remcos RAT and the call center operation as separate threats, and we do not link any incident to DarkComet without published technical evidence. If you spot an error, please email [email protected] and we will review it under our fact checking policy.

The Scam Exposed is an independent educational platform. We are not a government agency, law enforcement body, or legal advisors. Consult official channels for legal recourse. This article is general consumer education, not legal, financial or technical incident response advice.